Is Magento Open Source still supported? Versions, dates and risks.

The question comes up for two reasons. Adobe’s marketing talks almost entirely about Adobe Commerce, which leaves Open Source merchants wondering whether their edition has been quietly left behind. And “supported” means different things for different versions, so a merchant can be on a supported product and an unsupported release at the same time. Here is what Adobe’s own pages say, release by release, on 31st October 2026.

Is Magento Open Source still supported?

Yes, the product is alive and patched; the question is whether your release line is. Adobe released Magento Open Source 2.4.9 on 12th May 2026 and the first alpha of 2.4.10 on 13th October 2026, and its system requirements already list the services 2.4.10 is tested with. Since July 2026 every monthly Adobe security bulletin has listed fixed Magento Open Source versions; the October bulletin, APSB26-153, lists 2.4.9-2026-oct, 2.4.8-2026-oct, 2.4.7-2026-oct and 2.4.10-alpha1. What Adobe does not do is support every release forever. Each line has an end date, and after it, fixes stop for Open Source even though the product carries on.

What does “supported” mean for a Magento release?

Three years of fixes from the day the release line becomes generally available. Adobe’s lifecycle policy calls this standard support: quality fixes, security patches and, for Adobe Commerce customers, Adobe’s on-call support, for three years from general availability. Adobe Commerce customers get more on top. Lines 2.4.6 and 2.4.7 receive a further year of extended support at no extra cost, and 2.4.4, 2.4.5 and 2.4.6 have a one-time security-only period to 2027 or 2028 that Adobe describes as migration time, not a support tier. Adobe’s release policy is explicit that extended support security patches are available to Adobe Commerce customers only and not for the Magento Open Source code base.

Which Magento versions are supported today?

For Magento Open Source: 2.4.7, 2.4.8 and 2.4.9. The table gives Adobe’s dates for every 2.4 line. Read the third column if you run Open Source and the fourth if you hold an Adobe Commerce licence.

Release line	Released	Open Source support ends	Adobe Commerce, last fixes	Latest -p release
2.4.9	12th May 2026	31st May 2029	31st May 2029	2.4.9
2.4.8	8th April 2025	31st May 2028	31st May 2028	2.4.8-p5
2.4.7	9th April 2024	31st May 2027	31st May 2028 (extended)	2.4.7-p10
2.4.6	14th March 2023	Ended 11th August 2026	31st May 2028 (security-only)	2.4.6-p15
2.4.5	9th August 2022	Ended 12th August 2025	31st May 2027 (security-only)	2.4.5-p17
2.4.4	12th April 2022	Ended 12th April 2025	31st May 2027 (security-only)	2.4.4-p18
2.4.0 to 2.4.3	July 2020 to August 2021	Ended 28th November 2022	Ended 28th November 2022	2.4.3-p3

The “latest -p release” column matters because, since July 2026, Adobe’s monthly isolated patches apply only on top of it. A store on 2.4.7-p6 is on a supported line but cannot take this month’s fixes until it reaches 2.4.7-p10; Magento security patches explained sets out why.

What about Magento 1?

Magento 1 has had no fixes from Adobe since June 2020. Adobe’s bulletin APSB20-41, published on 22nd June 2020, delivered patch SUPEE-11346 for Magento Commerce 1 and Magento Open Source 1 and said that support for those editions was ending in June 2020 and that these would be the final security patches. Every Magento 1 vulnerability found since has stayed open unless someone outside Adobe closed it. In February and March 2026 we scanned 8.1 million .co.uk domains and still found 916 UK stores running Magento 1, more than five years after its last patch.

Is the rest of the stack supported too?

Not automatically, and Adobe says that part is yours. Adobe’s lifecycle policy states that it does not fix third-party dependencies such as PHP, MariaDB, OpenSearch, Redis, Valkey or RabbitMQ that reach end of life while a Commerce release is still supported. PHP is the one that bites. PHP 8.1 reached end of life on 31st December 2025 and PHP 8.2 reaches it on 31st December 2026, according to php.net. Adobe’s system requirements tie each line to particular PHP versions: the latest 2.4.6 runs on PHP 8.2 or 8.1, 2.4.7 on 8.3 or 8.2, 2.4.8 on 8.4 or 8.3, and 2.4.9 on 8.5. So a 2.4.6 store cannot reach a PHP version that is supported into 2027 without upgrading Magento first.

PHP	Security fixes end	Used by
8.1	Ended 31st December 2025	2.4.4, 2.4.5, 2.4.6
8.2	31st December 2026	2.4.6, 2.4.7
8.3	31st December 2027	2.4.7, 2.4.8
8.4	31st December 2028	2.4.8
8.5	31st December 2029	2.4.9

What are the risks of running an unsupported version?

Known holes that stay open, and attackers who read the same bulletins you do. When Adobe fixes a vulnerability in a supported line, the bulletin describes it, and anyone can compare old and new code to see what changed. An unsupported store keeps every one of those flaws. Adobe’s own security guidance says most site compromises are not the work of an innovative attacker, but of attackers taking advantage of existing, unpatched vulnerabilities, poor passwords and weak file permissions, and that the most common attack injects code into a store’s header or footer to capture what customers type at checkout. Our 2026 scan found 722 UK Magento stores already hijacked and serving spam pages, almost all of them on unsupported releases.

How do you find out which version your store runs?

From the code if you have access, from the outside if you do not. With server access, the command bin/magento --version prints the installed release, and the store’s composer.lock file records the exact package version, including the -p level, for magento/product-community-edition on Open Source or magento/product-enterprise-edition on Adobe Commerce. Since July 2026 the version alone is not the whole answer, so also run the Quality Patches Tool status command to list which isolated patches and hotfixes are applied. Without access, the release line, PHP version and much of the hosting setup can usually be read from what the store serves publicly; that is what our free health check does, without logging in or testing anything.

Write the answer down, with the date. The most common reason a store falls out of support is not a decision but the absence of anyone who knew which version it was on.

What should an Open Source merchant do now?

Find out exactly where you stand, then plan the move to 2.4.8 or 2.4.9 before your line’s date, not on it. Check the release line, the -p level and the PHP version. If you are on 2.4.6 or older, Adobe sends you nothing, so either upgrade now or have the open fixes backported as a short bridge. If you are on 2.4.7, you have until 31st May 2027, but PHP 8.2 ends on 31st December 2026, so a store on 2.4.7 with PHP 8.2 should move to PHP 8.3 this winter; our 2.4.7 end-of-support guide has the full plan. Mage-OS, a community distribution currently based on 2.4.9, is a variant of the same path for merchants who prefer community governance. And if the yearly upgrade cycle is more platform than the business needs, a move to Shopify is worth pricing alongside.